How do I confirm a host leaks data?

Run with --verbose. It prints samples of the disclosed memory so you can verify the finding instead of relying on a status flag alone.

What target formats does it accept?

An --input file with one target per line, accepting host, host:port, http(s) URLs, and mongodb URIs, so it slots in after most port scanners.

How do I scan only for vulnerable hosts?

Pass --quiet so mongobleed prints only the hosts that leak memory. Add --all-results when you need every checked target in the output for an audit trail.

What do --doc-len and --buffer-size control?

They tune the exploit payload: --doc-len sets the BSON document length (default 100) and --buffer-size sets the inflated buffer that triggers the leak (default 600). Leave the defaults unless you are reproducing a specific lab condition.

How do I speed up a large target list?

Raise --concurrency above the default 200 and keep --timeout short enough that dead hosts fail quickly. Quiet mode keeps the result set small while the scan runs wide.

Updated Jul 15, 2026

Scanners

Scan MongoDB hosts for the MongoBleed memory disclosure

High-performance scanner for the MongoBleed MongoDB memory disclosure flaw.

Test exposed MongoDB hosts for the bleed Triage a large estate fast Confirm findings with leaked samples

overview

What mongobleed does

mongobleed checks MongoDB hosts for CVE-2025-14847, a memory disclosure flaw triggered by malformed OP_COMPRESSED packets. It sends crafted requests against each target, watches for leaked memory in the response, and flags hosts that bleed data. The implementation follows Joe Desimone's published exploit technique.

It is built for scale. Feed it a file of targets in any of several forms, host, host:port, an http or https URL, or a mongodb URI, and run hundreds of connections in parallel. Quiet mode reports only vulnerable hosts, while verbose mode prints samples of the leaked data so you can confirm the finding rather than trust a status flag alone.

In a Trickest Scanners workflow, mongobleed takes a target file and writes a file and a folder of results. Place it after port discovery so it tests only hosts already known to expose MongoDB, keeping the scan focused and the output easy to triage.

source github.com/trickest

use cases

Where mongobleed fits

Test exposed MongoDB hosts for the bleed

Run mongobleed against hosts found listening on MongoDB ports to confirm which ones leak memory through the OP_COMPRESSED flaw.

Triage a large estate fast

Raise --concurrency to scan hundreds of hosts at once and use --quiet so the output lists only the vulnerable targets that need action.

Confirm findings with leaked samples

Enable --verbose to print samples of the disclosed memory, turning a yes/no result into evidence you can include in a report.

Chain after a port scan

Feed mongobleed the MongoDB hosts from naabu or masscan so the vulnerability check only touches services already confirmed open.

reference

mongobleed inputs and flags

9 inputs

Name	Type	Flag	Description
input	FILE	--input	File of targets, one per line; supports host, host:port, http(s)://host:port, and mongodb://host:port.
concurrency	STRING	--concurrency	Number of concurrent connections (default 200).
timeout	STRING	--timeout	Connection timeout in seconds (default 5).
quiet	BOOLEAN	--quiet	Quiet mode, show only vulnerable hosts.
verbose	BOOLEAN	--verbose	Verbose output with leaked data samples.
doc-len	STRING	--doc-len	BSON document length for the exploit (default 100).
buffer-size	STRING	--buffer-size	Inflated buffer size to trigger the leak (default 600).
all-results	BOOLEAN	--all-results	Include all results in output, not only vulnerable hosts.

Showing key inputs. mongobleed exposes 9 inputs in total.

Full flag reference (9 inputs)

Name	Type	Flag	Description
input	FILE	--input	File containing targets (one per line, supports: host, host:port, http://host:port, https://host:port, mongodb://host:port)
quiet	BOOLEAN	--quiet	Quiet mode (only show vulnerable hosts)
doc-len	STRING	--doc-len	BSON document length for exploit (default 100)
timeout	STRING	--timeout	Connection timeout in seconds (default 5)
verbose	BOOLEAN	--verbose	Enable verbose output with leaked data samples
no-color	BOOLEAN	--no-color	Disable colored output
all-results	BOOLEAN	--all-results	Include all results in output (not only vulnerable)
buffer-size	STRING	--buffer-size	Inflated buffer size to trigger leak (default 600)
concurrency	STRING	--concurrency	Number of concurrent connections (default 200)

example

Run mongobleed

mongobleed · command

# quiet scan of MongoDB targets for CVE-2025-14847mongobleed --input mongo-hosts.txt --quiet --concurrency 200 --timeout 5

sample output

198.51.100.10:27017 VULNERABLE203.0.113.25:27017 VULNERABLE192.0.2.40:27017 not vulnerablemongo.dev.example.com:27017 VULNERABLEdb.staging.example.com:27017 not vulnerable198.51.100.88:27017 VULNERABLEapi.example.com:27017 not vulnerable

guidance

Choosing mongobleed

Use mongobleed when you have MongoDB hosts and need to know which leak memory through CVE-2025-14847. It is a single-flaw scanner, not a discovery tool, so feed it a target list from a port scan and use quiet mode to surface only the vulnerable hits.

nuclei

Template-driven scanner that covers many CVEs. mongobleed is purpose-built and faster for this one flaw.

naabu

Port scanner that finds the MongoDB hosts to feed mongobleed. They run in sequence, not in competition.

mongobleed-loop

Same check applied across larger target sets when you need a wrapper around the core scanner.

faq

mongobleed questions

CVE-2025-14847, a MongoDB memory disclosure flaw reached through malformed OP_COMPRESSED packets. It flags hosts that return leaked memory in the response.

Run mongobleed yourself

A host list feeds naabu to find open MongoDB ports, then mongobleed tests those hosts for CVE-2025-14847 and writes the vulnerable ones as a queryable output.

Run mongobleed in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

input

FILE

--input

File of targets, one per line; supports host, host:port, http(s)://host:port, and mongodb://host:port.

concurrency

STRING

--concurrency

Number of concurrent connections (default 200).

timeout

STRING

--timeout

Connection timeout in seconds (default 5).

quiet

BOOLEAN

--quiet

Quiet mode, show only vulnerable hosts.

verbose

BOOLEAN

--verbose

Verbose output with leaked data samples.

doc-len

STRING

--doc-len

BSON document length for the exploit (default 100).

buffer-size

STRING

--buffer-size

Inflated buffer size to trigger the leak (default 600).

all-results

BOOLEAN

--all-results

Include all results in output, not only vulnerable hosts.

Name

Type

Flag

Description

input

FILE

--input

File containing targets (one per line, supports: host, host:port, http://host:port, https://host:port, mongodb://host:port)

quiet

BOOLEAN

--quiet

Quiet mode (only show vulnerable hosts)

doc-len

STRING

--doc-len

BSON document length for exploit (default 100)

timeout

STRING

--timeout

Connection timeout in seconds (default 5)

verbose

BOOLEAN

--verbose

Enable verbose output with leaked data samples

no-color

BOOLEAN

--no-color

Disable colored output

all-results

BOOLEAN

--all-results

Include all results in output (not only vulnerable)

buffer-size

STRING

--buffer-size

Inflated buffer size to trigger leak (default 600)

concurrency

STRING

--concurrency

Number of concurrent connections (default 200)

198.51.100.10:27017 VULNERABLE203.0.113.25:27017 VULNERABLE192.0.2.40:27017 not vulnerablemongo.dev.example.com:27017 VULNERABLEdb.staging.example.com:27017 not vulnerable198.51.100.88:27017 VULNERABLEapi.example.com:27017 not vulnerable

Scan MongoDB hosts for the MongoBleed memory disclosure

What mongobleed does

Where mongobleed fits

Test exposed MongoDB hosts for the bleed

Triage a large estate fast

Confirm findings with leaked samples

Chain after a port scan

mongobleed inputs and flags

Run mongobleed

Choosing mongobleed

nuclei

naabu

mongobleed-loop

mongobleed questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run mongobleed yourself

Scan MongoDB hosts for the MongoBleed memory disclosure

What mongobleed does

Where mongobleed fits

Test exposed MongoDB hosts for the bleed

Triage a large estate fast

Confirm findings with leaked samples

Chain after a port scan

mongobleed inputs and flags

Run mongobleed

Choosing mongobleed

nuclei

naabu

mongobleed-loop

mongobleed questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run mongobleed yourself